Solution

While reading the code, I was a little lost at the begining until I saw this :

auth = malloc(sizeof(auth));

This doesn’t allocate enough space for an auth structure but only 4 bytes (auth is a pointer).
If the variable ‘service’ is allocated in the heap just after ‘auth’, when the program calls auth->auth, it is in the heap allocation of ‘service’.
Let’s see :